What does the California Privacy Protection Agency do?In Europe, individual data protection authorities from the 27 EU member states enforce the GDPR. In California, until the creation of the CPPA, all enforcement fell within the California Attorney General’s purview. And that’s on top of their other responsibilities as the top legal officer in the state.
When Californians voted “yes” on the CPRA in 2020, they created the CPPA and “vested it with the full administrative power, authority and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.”
With 34 data privacy experts on staff and an annual budget of $10,000,000, the CPPA is well-funded and well-equipped to carry out its task. Compare that to the national FTC division on privacy protection, which budgeted $1,000,000,000 for the entire country for ten years. The budget and resources allocated to the CPPA are a substantial investment in Californians’ privacy.
The CPRA goes into effect on January 1, 2023, and enforcement begins on July 1, 2023. At that time, businesses that do not comply with the CPRA may face fines, and “I didn’t know” won’t keep you from facing consequences. Each violation carries a fine of $2,500. On the other hand, businesses that intentionally violate the CPRA or have violations involving minors will be fined $7,500 for each violation.
Can someone take private action through the CPPA?For the most part, the California Privacy Protection Agency will focus on how businesses collect and protect personal information. However, the CPRA expands upon the CCPA’s limited private right of action in the case of a data security breach by adding email and password or security questions and answers into a group of items that, if unlawfully accessed, permit a consumer to bring a claim directly against the company. In this case, a person may be entitled to a settlement between $100 and $750 per incident, or the actual damages.
The CPPA: What will they do first?The agency has been performing information-gathering activities and working with the public and stakeholders to advance the rulemaking process. In late May, they released CPRA draft regulations, which detailed:
- Mandatory user opt-out signal acknowledgment
- Privacy notice requirements
- The requirement to notify service providers and contractors to delete information
- Personal collection and use restrictions
After the public hearing and comment period, the board will reconvene for a final hearing. At the meeting, the board will vote on rule approval and file the final package with the California Office of Administrative Law.
Although the initial deadline for adopting statutory regulations was July 1, the executive director says the agency will complete it in Q3 or Q4. With the release of the draft, we can see that the CPPA is intent on focusing on consumer privacy.
What seems like a win for consumers is receiving significant pushback from trade groups that argue against the mandated global opt-outs and technical requirements. Advocacy groups are on the other side, urging the CPPA not to back down.
Ultimately, the goal of the CPPA is to protect consumer data. Consumers will easily understand the collected information and how companies use it once the regulations are finalized. Then, consumers can make informed choices about whether or not to allow a business to use their data.
Stay up-to-date with the latest Privacy News via Privacy InsiderYou can expect more rules and regulations now that the California Privacy Protection Agency is funded and active. If your business is based in or has visitors from California, not knowing the latest news could result in a hefty fine.
Osano publishes a weekly newsletter to help you stay up-to-date on the latest privacy trends, news, and legislation so you’re never left in the dark. Sign up now — being familiar with the latest developments in privacy is an easy step toward ensuring compliance and avoiding a penalty from the CPPA.